Across CMMC pre-assessments our team has run for defense subcontractors over the last twelve months, three NIST 800-171 control families have been disproportionately responsible for the gaps that drive remediation work. If you have a CMMC Level 2 assessment on the calendar, these are the areas worth attention first.
1. Access Control (3.1)
The single most common gap area. Specifically: enforcing approved authorizations for logical access (3.1.1 and 3.1.2), separation of duties (3.1.4), and the use of non-privileged accounts when accessing nonsecurity functions (3.1.6). Most subcontractors have access controls — but the documented evidence that those controls are operating consistently is often thin.
The fix is rarely a tooling problem. It's usually a process and evidence problem: who reviews access, how often, what does the evidence trail look like, and how would you produce that for an assessor.
2. Audit and Accountability (3.3)
Audit logging requirements under 3.3 are extensive and assessor expectations are sharp. The frequent gaps: inadequate audit log review (3.3.5), insufficient audit record content for the system in question (3.3.1), and missing capability to limit audit information to authorized users (3.3.8).
Most environments have logging. Few have a documented review cadence with evidence of execution. That gap is what assessors find.
3. System and Communications Protection (3.13)
FIPS-validated cryptography (3.13.11) is one of the most cited gaps because subcontractors discover late that the encryption they have deployed isn't FIPS-validated as configured. Boundary protection (3.13.1) and CUI separation (3.13.13) also show up regularly when CUI environments aren't properly isolated from corporate IT.
What to do first
If you're more than six months out from your assessment, do a focused gap analysis on these three families before broader remediation work. The investment of effort here returns the largest reduction in assessment risk per dollar spent. Beyond six months, broader 800-171 work makes sense — but the order matters because remediating these families often surfaces dependencies that change the rest of the plan.